{"id":5401,"date":"2018-10-12T20:09:08","date_gmt":"2018-10-12T20:09:08","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=5401"},"modified":"2018-10-12T20:11:26","modified_gmt":"2018-10-12T20:11:26","slug":"beyond-good-ol-run-key-part-93","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2018\/10\/12\/beyond-good-ol-run-key-part-93\/","title":{"rendered":"Beyond good ol\u2019 Run key, Part 93"},"content":{"rendered":"<p>I was pretty surprised to find this one as I have looked at kernel32.dll many times before. Seeing a code branch that is responsible for enumerating registry subkeys and loading the DLLs, and one that has not been discussed before, is a rare treat so it immediately found its way to this series&#8230;<\/p>\n<p>The actual code resides inside the <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/desktop\/api\/winnls\/nf-winnls-notifyuilanguagechange\">NotifyUILanguageChange<\/a> API. Despite MS claiming that it is unsupported it is still being used internally by a number of components. Chances for it to go away soon are probably low. As far as I can tell, the function in question is called when certain system settings are changed &#8211; I will show you how to trigger it in a second \ud83d\ude42<\/p>\n<p>The code enumerates entries under this Registry key:<\/p>\n<ul>\n<li>HKLM\\System\\CurrentControlSet\\<br \/>\nControl\\MUI\\CallbackDlls\\<br \/>\n{ENTRY}\\DllPath=&lt;DLL&gt;<\/li>\n<\/ul>\n<p>On Windows 7, we can see a number of these entries:<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/10\/callbacks1.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-5403\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/10\/callbacks1.png\" alt=\"\" width=\"500\" height=\"124\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/10\/callbacks1.png 868w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/10\/callbacks1-300x74.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/10\/callbacks1-768x190.png 768w\" sizes=\"(max-width: 500px) 100vw, 500px\" \/><\/a><\/p>\n<p>and Windows 10 has even more &#8211; I really doubt this code is going away:<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/10\/callbacks2.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-5404\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/10\/callbacks2.png\" alt=\"\" width=\"500\" height=\"153\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/10\/callbacks2.png 770w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/10\/callbacks2-300x92.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/10\/callbacks2-768x235.png 768w\" sizes=\"(max-width: 500px) 100vw, 500px\" \/><\/a><\/p>\n<p>Each entry includes the DllPath that points to a library. The only requirement is that all these libraries must be signed&#8230;<\/p>\n<p>Now, how to trigger it?<\/p>\n<p>It&#8217;s simple: just change the system locale&#8230;<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/10\/callbacks4.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-5405\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/10\/callbacks4.png\" alt=\"\" width=\"300\" height=\"337\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/10\/callbacks4.png 484w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/10\/callbacks4-267x300.png 267w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a>Once you do that, you can observe Procmon log showing the enumeration:<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/10\/callbacks3.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-5419\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/10\/callbacks3.png\" alt=\"\" width=\"500\" height=\"435\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/10\/callbacks3.png 960w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/10\/callbacks3-300x261.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/10\/callbacks3-768x669.png 768w\" sizes=\"(max-width: 500px) 100vw, 500px\" \/><\/a><\/p>\n<p>Again, the exact criteria when the DLLs are loaded and how are not clear to me, and there may be other times when the code is triggered, but finding these out is a homework exercise for the reader \ud83d\ude09<\/p>\n<p>It&#8217;s certainly not the best persistence mechanism, but yet another place to look at, just in case&#8230;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I was pretty surprised to find this one as I have looked at kernel32.dll many times before. Seeing a code branch that is responsible for enumerating registry subkeys and loading the DLLs, and one that has not been discussed before, &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2018\/10\/12\/beyond-good-ol-run-key-part-93\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13,35],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/5401"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=5401"}],"version-history":[{"count":7,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/5401\/revisions"}],"predecessor-version":[{"id":5422,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/5401\/revisions\/5422"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=5401"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=5401"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=5401"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}